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[57] ABSTRACT 

A workstation manages and controls a plurality of commu- 
nication networks using different protocols coupled to a 
common bus. A programmable digital filter connected 
between the workstation and the networks examines frame 
information using real time calculation for identifying pro- 
tocols in the frames.. The filter identifies and counts 
addresses, security^condilions- and other i nformation nf 
interest^ oi uthe bus and_p xcimin^.in thr, networks. The 
p rotocol, address^ exurity^ata^d^mer^ nfo 
i nterest counted by^the filter are storedJn^tojca geJQr_access 
b y anjnter preter. The stored data for the networks accessed 
by the interpreter is compared to network models for iden- 
tification of traffic problems and conditions and load bal- 
ancing. The network interpreter contains a graphical user 
interface which displays selected information at a monitor 
for an operator to examine and initiate corrective action by 
initiating commands. A microprocessor executes the com- 
mands for overcoming the traffic condition or problem 
occurring on the different networks. The microprocessor is 
further adapted to initiate load balancing in the networks 
according to the commands issued by the interpreter. 
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SYSTEM AND METHOD FOR A 
WORKSTATION MONITORING AND 
CONTROL OF MULTIPLE NETWORKS 
HAVING DIFFERENT PROTOCOLS 

5 

BACKGROUND OF THE INVENTION 

1 . Field of the Invention 

This invention relates to data communication networks. 
More particularly, the invention relates to systems and 10 
methods for work station control of multiple networks using 
different protocols. 

2. Description of Prior Art 

Monitoring and controlling data networks is a necessary 
function for efficient operation of such networks. Without 15 
information indicating the status of the network with respect 
to faults, data rates, block sizes, intrusion, data switching, 
etc., successful operation of such networks may not be 
achieved. Monitoring and controlling of multiple data net- 
works magnifies the problem. Moreover, the ability to 20 
manage and control multiple networks using different pro- 
tocols from a single workstation raises the problem to 
another level. 

In the related art, U.S. Pat. No. 5,023,873 issued Jun. 11, 
1991 describes a communication link manager for problem 25 
determination and recovery of failing resources on a com- 
munication link. When a problem occurs on a link segment, 
the using node passes link event data to the communication 
link manager for analysis. The manager interacts with a 
configuration database to determine the physical configure- 30 
tion of the failing link and the controlling link connection 
subsystem manager. The link manager directs the appropri- 
ate link connection submanager to initiate tests of the 
various link connection components on the link segment 
under its control. When the failing resources is identified, the 35 
communication link manager initiates the appropriate non- 
disruptive recovery procedure through the link connection 
subsystem manager and prompts the data link to restart the 
line. 

40 

U.S. Pat No. 5,132,962 discloses a serial communication 
network and more particularly a fault isolation and by-pass 
reconfiguration unit for use in a dual token ring serial 
communications network. The unit employs three adapters 
which in the presence of an internal fault establish an 4J 
isolated token ring. The token ring includes one of the 
adapters and an associated port, to test and by-pass the 
default, while operating the reconfigured ring with the other 
two adapters. 

U.S. Pat. No. 5,097,469 discloses a passive malfunction 50 
and performance monitor for a broadcast communications 
network. A network monitor passively detects sequence of 
control frame transmissions. The detected control frame 
sequences are compared, in real time, to a model of the 
expected change of control frames. The monitor concludes 55 
a malfunction has occurred when the detector control frame 
sequences do not match the frame sequences indicated by 
the model. The observed malfunctions are then recorded for 
corrective action. 

U.S. Pat. No. 5,329,521 issued Jul. 12, 1994 discloses 60 
redundant local area network systems which enable network 
nodes otherwise unable to operate in redundant systems to 
operate in such systems. A plurality of communication nodes 
are operable to transmit and receive information across a 
plurality of communications links. Redundant adapters are 65 
coupled between the communications links and communi- 
cation nodes, such that communication nodes are capable of 



transmitting and receiving information across each of the 
communication links. 

In IBM Disclosure Bulletin, December 199i, pages 
164-166, a fault tolerant host channel adapter is coupled 
between a fault tolerant computer system and a host system 
by emulating a control unit. The emulation is achieved 
through loadable microcode which may be altered to emu- 
late a specific control type executing on the fault tolerant 
hardware. Different control unit emulations are achieved by 
loading separate emulation code modules. Errors in the 
operation of a particular emulation may be corrected by 
simply changing the emulation code. 

None of the prior art discloses or suggests monitoring 
and/or controlling multiple data networks using different 
protocols from a single workstation. Nor does the prior art 
disclose or suggest altering the operation of such monitored 
and controlled networks based upon information collected 
and interpreted by the workstation. 

Accordingly, a need exist in the art to monitor and control 
multiple data networks using different protocols from a 
single workstation adapted to alter the-operation of such 
networks based upon information collected and interpreted 
by the workstation thereby enhancin g the performan cejuid 
Utilization Of da taco mmunifatian,sygtftmg 



SUMMARY OF THE INVENTION 

An object of the invention is a system and method using 
a workstation that is either external to or embedded within 
a router, hub, or switch fo r mnnit;p rin&__and controllin e. 
thr ough a common bus multiple networks hayi ng-different ) 
p rotocols. 

Another object is a system and method using a single 
workstation and a passive, real time monitor for controlling 
through a common bus multiple data networks using differ- 
ent protocols. 

Another object is a system and method using a worksta- 
tion including an interpreter and a passive, real time monitor 
coupled via a common bus for monitoring and controlling 
multiple data networks having different protocols. 

Another object is a system and method using a worksta- 
tion and a passive, real time monitor coupled to a common 
bus for detecting faults in multiple networks using different 
protocols. 

Another object is a system and method using a worksta- 
tion including an interpreter and a real time, passive monitor 
to control concurrently multiple data networks using differ- 
ent protocols for fault detection diagnosis and network 
recovery purposes. 

Another object is a workstation including an interpreter 
and a real time, passive monitor coupled through a common 
bus to multiple data networks using different protocols for 
the allocation of bus capacity through altering the networks. 

Another object is a workstation, interpreter and a passive, 

real time monitor for iHCTtjfying nrtwnrV prntncn kJn pack ftl 

data.frames on multiple networks using different protocols 
f or correcting operations on networks experiencing traffic 
p roblems. 



i 



These and other objects features and advantages are 
achieved in a system and method including a workstation 
having storage means and an interpreter coupled to a bus 
including an address line, data and control lines. Multiple 
data communication networks such as token ring, ethernet, 
FDDI, ATM, etc. having different protocols are coupled to 
the common bus for monitoring and control purposes by the 



07/11/2004, EAST 



Version: 1.4.1 



5,568,471 



10 



workstation. A real time passive monitor detects traffic 
patterns in packet data frames. The pa^mc ^ jnfljrativ^ ff f 
events^j uch^as faults, jdata-actiy i_ty. intrusion, etc. on th e 
res gg5Gve networks. The passive monitor is aaaptecTto 
identify a network from an address transmitted to the 
workstation. The passive monitor is also adapted to identify 
network protocols using real time calculation of variable 
offset fields in the data frame. Based upon counts of different 
traffic patterns by the passive monitor, faults can be counted 
on the data, address and control buses. Also, the data activity 
can be calculated on the multiple networks by the passive 
monitor based upon the protocol associated with such net- 
work. The interpreter included in the workstation can initiate 
corrective action on such networks through a microproces- 
sor which initiates commands to the different networks as 
required for load balancing, fault correction and substitution 
of stand-by adapters. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The invention will be more fully apprehended from the 
following detailed specification taken in conjunction with 
the following drawings, in which: 

FIG. 1 is a block diagram of a workstation coupled to 
multiple networks through a common bus implementing the 
principles of the present invention. 

FIG. 2 is a representation of a data frame format trans- 
mitted on the networks of FIG. 1. 

FIG. 3 is a representation of a file repository included in 
the workstation of FIG. 1. 

FIG. 4 is a conceptual graphic user interface (GUI) for an 
interpreter included in the workstation of FIG. 1. 

FIG. 5 is a representation of the functions performed by 
a microprocessor responding to instructions provided by the 
interpreter for controlling the multiple networks in FIG. 1. 

FIG. 6 is a flow diagram of a process monitoring and 
controlling the multiple networks of FIG. 1. 

DESCRIPTION OF THE PREFERRED 
EMBODIMENT 

In FIG. 1, a workstation 10 such as an IBM RS 6000 
which performs pouting, swiftin g, or HUB fu nctions 
includes a common bus_12 having co ntrol line s 14. addr ess 
lines 16 and data lfoes IS Thp. common bus is coupled to 
multiple communication networks 20-1 .... 20-(n) by way 
of respective communication adapters 22-1 . . . 22-(n). A 
passive, real time monitor 23, such as a programmable 
digital filter is also coupled to the bus for monitoring o f 50 
traffi c patterns on the respective cornmunication networks 
One programmable digital filter which has application to the 
present invention is an event driven interface described in 
U.S. Pat. No. 5,365,514 issued Nov. 15, 1994 and U.S. Pat 
No. 5,375,070 issued Dec. 20, 1994, both assigned to the 
assignee of the present invention, and incorporated herein in 
their entirety. The filter or event driven interf ace is adapted 
to monitor simultaneously dynarnicaHy-Tmanging event? 
such as fault and protocol infntTnarinrr-4f £am*g^^ 

fcTTm^mries wmng frany* n r ypll length, ^r) ; fault and 



20 



25 



30 



35 



40 



45 



55 



frequency of adapter access on the address line 16, and 
fault/security information on the control line 14. 

Also included in the workstation is a file storage system 
24 including a database which is accessed by an interpreter 
26 for analyzing the collected data versus network models. 
Based upon the analysis performed by the interpreter com- 
mands of Actions 29 are generated for changing the ge t, 



60 



65 



works according to t he^a ffic conditi6n_^ xistin^on_the 
nelwor^The commands generated by the interpreter are 
implemented by a processor 28 in initiating corrective action 
on a network experiencing a traffic problem or condition. 

The filter 23 is programmable, as described in U.S. Pat. 
No. 5,365,514, supra, to locate within each frame 30, shown 
in HG. 2, embedded information indicative of protocol used 
in a network. The protocol can be correlated with data from 
the network. The network data can be organized and stored 
in the file storage system 24 for use by the interpreter 26 and 
microprocessor 28. 

As one illustration the data frame, shown in FIG. 2, may 
be a standard frame used on an IBM token ring network. The 
fea^e_coritains ^a header 12_which amonp other thin gs- 
includes a jpecification lorfae locat ion of an informati on 
fieJdJ4jd£Sr£a^l0^^ 

p rotocol information. O ne problem with the frame is that the 
p osffiolToTTF^^ is not fixed with respect to th e 

heaaerj^ The lorationfbr the held 34 is specified in a 
routing indicator field 36 for a token ring implementation. 
The filter 23 receives a serial bit stream on the bus 18 and 
when the frame 30 is identified by a characteristic for 
example, the header 12, the filter will detect a pattern of bits 
up to the point where the routing indicator 36 is located. The 
routing indicator bit determines whether the frame 30 is a 
communication within a network or whether the communi- 
cation is from a network-to-network over a bridge or gate- 
way. If the routing bit is for a frame within the network, the 
size of a routing field 32 is fixed whereby the length field 38 
can be ignored so that the desired information 34 can be 
subjected to pattern recognition by the filter 23. 

However, if the communication bit indicates a frame is 
intended to go to another network, the size of the field 32 is 
variable. Since the field 32 is variable, the filter will store the 
length field 38 in a register (not shown). The register is the 
address register for the filter which initiates a loop ignoring 
the number of bits in the variahla-fiizejnuting ffelri 32 After 
the number of bits has passed into the filter 23, the infor- 
mation field 34 can be subject to pattern analysis in spite of 
the variable size routing field 32 which separates the infor- 
mation field 34 from the header 12. The details of real time 
calculation of the location of variablably offset fields in a 
data frame for identifying protocol information, are 
described in Ser. No. 08/188,167, filed Ian. 26, 1994, 
abandoned in favor of continuation application Ser. No. 
08/551,283, assigned to the same assignee of the present 
invention and incorporated herein in its entirety by refer- 
ence. With this feature, offset based embedded information 
can be located within each frame by the filter 23 and the 
interpreter 26 can identify both the protocol used to encap- 
sulate the frame and any protocols embedded in the frame. 
Since destination 40 and source 42 addresses are contained 
in the frame 30, the various traffic patterns on the networks 
can be identified and counted by the filter 23 for storage in 
the storage file 24 for each network. 

In FIG. 3, the counts accumulated by the filter 23 for the 
d ifferent networks_on .meuiata J 18,jaddress 16 and control 14 
li nes can be stored in the ■ stora gejneansJM^Axi atfl nne_h ie 
50 can be organized m the storage means 24 into several 
sub-filesra^sub=fil e'SO^ c^Sinin g tfie^m^ 5£lfaults 
occuiTmg^orrth"e s data line 18 and cou^Tbythe filter 23; a 
sub^fi le "50-2~iiiidicat^ m emory 
accesses occurring on the data line together with block sizes, 
and a pr6tocol^blfile"5,0l3* mfl^ number nf fra mf g 

transmitted on'the i different j^etwork^ ' 
v An address file 52 can be organized in the storage means 
24, the file containing a fault sub-file 52-1 indicating the 
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total number of faults on the address lines; an adapter 
frequency sub-file 52-2 indicating the number of frames 
transmitted or received on the different networks through the 
respective adapters. 

Finally, a control line file 54 can be organized in the 5 
storage means 24 to indicate in a sub-file 54-1 the number 
of faults on the control line 14 and the number of security 
infractions in a security file 54-2. The sub-file 54-2 may be 
broken down into the number of intrusion detections and 
message authentication events occurring on the control line 10 
14. 

In FIG. 4, a graphical user interface 60 contains a series 
of windows 62 indicating router topology for the worksta- 
tion 10; a fault monitoring window 64 indicating fault 
conditions on the network with a switch 65 to switch in a 15 
substitute adapter for a defective adapter, and an adapter 
performance window 66 i ndicating the block sizes of data 
tTflngmi^qd pypr thr riifferrnt nfflvftrlri Tn> intprprrtrr also 
contains a window 68 showing , multiple workstation pro- 
cessors milization on_a task-b y^task basis Qcaimrig -in the 20 
workstation 10. .An operator viewing the interface 60 can 
take action to generate commands correcting traffl condi- 
tion or pro blemoccurring injlt e^e^pecdv^s^ii^^sT The 
iriformation and displays generated in each window are 
obtained by accessing the storage means 24 using standard 25 
stored program instructions contained in the interpreter. One 
example of an interpreter applicable to the present invention 
is described in Sen No. 08/204,542, filed 1 Mar. 1993 
entitled "System and Method For Configuring An Event 
Driven Interface and Analyzing Its Output For Monitoring 30 
and Controlling A Data Communication Network" U.S. Pat 
No. 5,493,689. 

The commands initiated by the interpreter 26 are supplied 
to the microprocessor 28 for corrective action in the respec- 
tive networks as traffic problems or conditions arise. In FIG. 35 
5, a partial list of corrective actions is given, it being 
understood, that other commands may be generated for other 
error or fault conditions occurring in the network. 

A first command would be to increase or decrease data 
transfer rates to or from specific adapters using direct 40 
memory access (DMA). DMA is a technique in which the 
adaptor bypasses a computer's central processing unit and 
directly handles the transfer of data between the adapter and 
the system memory. This is accomplished by the program- 
mable digital filter or real time passive monitor capturing 45 
internal processor information generated through DMA 
activity to or from an adapter card. Based on the activity 
information supplied to the interpreter, the flow n f traffic _tn 
I certain adapters can be increase d ntu^ms\^ tP opting 

^ t raffic flow for internal workstation busV ansfers- 50 

A second command relating to rarffmanagement would 
switch in a hot stand-by adapter for an adapter that has 
failed. This is accomplished by the programmable digital 
filter monitoring the address, data and control lines for error 55 
control information available on an active network adapter. 
Upon detection by the filter of a failure, the interpreter 
would automatically switch over to the hot stand-by adapter. 

A third command would remove an adapter from the 
network when an intrusion detection has been discovered by go 
the filter 23. This would be accomplished by the interpreter 
maintaining a table of permissible network addresses. If the 
filter detects an address that is not in the table an intrusion 
would be recognized for corrective action. 

A fourth command would initiate a display of router 65 
topology showing the monitoring facility, faulty links, and 
an indication of alternate paths. One method to accomplish 



this would be to develop a simple network management 
protocol (SNMP) — like 'management information base 
(MIB) with the assistance of the programmable digital filter. 
A MIB provides a^eMrfjDarainejer^^ 
agemen t station^ can query. T his information would be 
■t^ganTzecl into atopological map of the network. The map 
would be displayed using a graphical users interface (GUI). 

A fifth command would relate to optimizing task break- 
down between multi-processors within a single workstation. 
This would be accomplished by the filter checking the cycle 
times and I/O of the processors in a multiprocessor work- 
station. The cycle times and I/O information would be 
supplied to the interpreter which , would use mathematical 
algorithms to determine whether or not a processor was over 
or under utilized and then would optimize the workload 
served by the processors. 

In FIG. 6, a flow diagram describes the processes imple- 
mented in the workstation and filter for monitoring and 
controlling the networks of FIG. 1. 

In a step 501 the filter 23 identifies and counts the network I 
address on the address bus for each network and stores the J 
network address together with the frequency of use of the 
network in the storage means 24 along with fault data 
occurring on the address bus. The data is storied in the 
storage means in the form shown in file 52 of FIG. 3. 

In a step 503, the filter 23 identifies and counts faults and 
security violations or other information of interest occurring 
on the control line 14 and stores the data in the control 
detection file 54 of the storage means 24 shown in FIG. 3. 

In a step 505, the digital filter examines each frame on the 
data line 18 for protocol or other information of interest 
using processes described above and in Ser. No. 08/188,167, 
filed Jan. 26, 1994, abandoned in favor of continuation 
application Ser. No. 08/551,283, which together with the 
number of faults and direct memory accesses or other 
information of interest occurring on the bus 18 are stored in 
the data line detection file 50 in the storage mean 24 shown 
in FIG. 3. 

In a step 507, the interpreter 26 accesses the storage 
means 24 to examine the information stored in the files 50, 
52, and 54 relative to models for each network. 

In an operation 509, the interpreter generates commands 
indicating corrective conditions on the respective networks 
based on a comparison between the stored data and the 
network models. 

In an operation 511, the interpreter processes the stored 
data to generate data for display in the graphical users 
interface shown in FIG. 4. TTie windows of the display 
indicate relative to various parameters and conditions occur- 
ring in the networks. 

In an operation 513, interpreter commands are sent to the 
processor 28 for operating and controlling switching cir- 
cuitry in the various networks to overcome the traffic prob- 
lem or condition on the network identified by the interpreter. 

Summarizing, an improved single workstation has bee n 
disclosed for managing and controlling multiple communi- 



cation netw orks using differe nt prntQcois and rmiplftd tn the 
wor^staT rornhrough a common bus. A programmable digital 
filter coue cts ana counts traffic conditions and problems on 
e ach re5gecuye„network using real toe Jd eiitification^of 
p rotocols^en capMatirigjor-em 

on the common bus. Hie filter stores addresses, frame data, 
an3"staUstics derived from the network and control infor- 
mation in respective files in a storage means. An interpreter 
analyzes the stored data for each versus network models and 
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gen erates commands for (prrectffi ^nnriitioTrHn such net- 
wprles JThe interpreter alscPdi sjiiays traffic conditions in the 
networks on a graphical user interface, A microprocessor 
implements the commands for changing the networks^ 
o vercome traffic_problems^an d. conditions as well as load 5 
balancing among the networks. The real time monitoring 
and control of multiple communication networks using 
different protocols by means of a passive monitor in com- 
bination with storage means, interpreter and processor will 
enhance the performance and utilization of a single work- 10 
station in managing and controlling multiple networks using 
different protocols. 

While the specific embodiment of the invention has been 
disclosed, it will be understood by those having skill in the 
art that changes can be made to the embodiment without 15 
departing from the spirit and scope of the invention. 

What is claimed is: 

1. A workstation for monitoring and controlling multiple 
communication networks using different protocols compris- 
ing: 20 

a common bus coupling the workstation to a plurality of 
network adapters, the bus including data, address and 
control lines; 

each adapter connected to a different network using a 25 
protocol; 

a programmable digital filter coupled across the bus for 
collecting data, address and control information indica- 
tive of traffic events occurring on the common bus for 
each network, the filter identifying the protocols on the 30 
bus to count traffic events for each network; 

means for receiving and storing in files information 
indicative of traffic events occurring on the address, 
data, and control lines for the networks; 

an interpreter accessing the stored files for analyzing the 35 
performance of each network and generating (i) a 
graphical display of conditions existing in the networks 
and (ii) commands for correcting traffic problems and/ 
or balancing communication loading among the net- 
works as identified from the traffic events occurring in 40 
the networks; and 

a processor for implementing the commands in the net- 
works to overcome such traffic conditions and balance 
communication loading among the networks. 

2. The workstation of claim 1 further including a graphi- 45 
cal user interface for displaying traffic conditions occurring 

in the networks. 

3. The workstation of claim 2 wherein data frames are 
transmitted on the networks, each frame including a routing 



8 

indicator for identifying whether the frame is within a 
network or between networks. 

4. The workstation of claim 3 wherein the routing indi- 
cator identifies the location of an information field in the 
frame relative to a frame header. 

5. The workstation of claim 4 wherein the information is 
stored in the files by data, address and control lines. 

6. The workstation of claim 5 further including direct 
memory access (DMA) for enabling the filter to capture 
DMA activity between an adapter and the workstation to 
optimize traffic flow in the networks. 

7. The workstation of claim 6 wherein the filter detects 
and reports a failed adapter to the interpreter for switching 
the network to a hot standby adapter to replace the failed 
adapter. 

8. The workstation of claim 7 wherein the stored files 
include a table of addresses of active networks for network 
intrusion determination by the interpreter based upon 
address information detected by the filter. 

9. The workstation of claim 8 further including multipro- 
cessors and wherein the filter detects processor cycle times 
and input/output activity as an input to the interpreter for 
optimizing the workload served by the processors. 

10. In a workstation coupled to a plurality of networks 
through a common bus including address, data and control 
lines, a method of monitoring and controlling multiple 
communication networks using data frames and different 
protocols, comprising the steps of: 

a) identifying and counting network addresses on the 
address line using a programmable digital filter; 

b) storing the network addresses in a storage means; 

c) identifying and counting network fault and security 
violations in the networks using the filter; 

d) storing the fault and security violation information in 
the storage means; 

e) examining data flames on each network for protocol 
information using the digital filter; 

f) storing the protocol information in the storage means; 

g) examining the stored information in the storage means 
relative to network models for traffic problems on the 
networksmsing an interpreter, 

h) generating commands for correcting traffic problems 
identified as occurring on the networks; and 

i) implementing the commands in the networks to correct 
traffic problems occurring in the networks using a 
processor. 

***** 
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